A security architect is configuring a zero-trust network ingress path for an administrator connecting remotely to a sensitive database in an isolated zone. Arrange the operational steps for establishing this administrative session in the correct chronological sequence, from initial external initiation to final host authorization.
- 1The remote client initiates an encrypted management session to a dual-homed bastion host residing in the DMZ via an external firewall ingress rule.
- 2The bastion host authenticates the administrator using multi-factor authentication (MFA) and issues a short-lived session token.
- 3An internal stateful firewall inspects traffic and permits East-West transit originating specifically from the bastion host IP to the database segment.
- 4The host-based microsegmentation agent on the database server validates process-level rules and allows connection termination.
Cevap
The correct chronological sequence begins with establishing the encrypted transport session to the DMZ bastion host, authenticating identity via MFA on the bastion host, filtering East-West network traffic at the internal stateful firewall, and enforcing endpoint microsegmentation policy on the database server.
Establishing remote administrative access into a restricted segment requires a defense-in-depth sequence. Initial encrypted transport terminates at a DMZ bastion host, followed by MFA verification. Next, stateful internal firewalls allow East-West transit only from the verified jump host IP. Finally, the target host applies microsegmentation policies to validate process identity and grant connection access.
Adım Adım Çözüm
Anahtar Kavram
Secure Jump Host Transit and Microsegmentation Enforcement